CVE-2020-28976: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.

Security readout for executives and security teams

CVE-2020-28976 is an unauthenticated blind SSRF issue in the Canto WordPress plugin 1.3.0. A public WordPress site using that version may be abused to make the server contact internal or external systems, potentially exposing internal services to probing through the website. Exposure is most likely on public WordPress sites running the Canto plugin version 1.3.0, especially if the vulnerable plugin files are reachable without authentication. Prioritize internet-facing WordPress sites using Canto 1.3.0. The issue can turn a public website into a network request relay, but available evidence does not confirm active exploitation or a vendor fix. Mitigation focus: Inventory WordPress sites for the Canto plugin and confirm installed versions.; Disable or remove Canto plugin 1.3.0 if not required.; Check Canto and WordPress plugin guidance for a fixed or supported version..

Prepared

Jun 5, 2026, 13:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.